Responsive Blocks Page Builder For Blocks Patterns CVE-2026-6675

Update Responsive Blocks plugin to version 2.2.1 or later immediately. Because the vulnerability is unauthenticated and public-facing, any WordPress site running versions up to 2.2.0 is at risk regardless of other security measures. For sites unable to update immediately, the primary compensating control is to disable the affected REST API endpoints by adding a must-use plugin (MU-plugin) that blocks requests to the vulnerable routes-specifically, routes matching the email sending endpoints in responsive-block-editor-addons.php. Add the following filter to mu-plugins/block-rest-disable.php: add_filter( 'rest_endpoints', function( $endpoints ) { unset( $endpoints['/responsive-block-editor-addons/v1/send_email'] ); return $endpoints; }, 10, 1 ); This prevents exploitation while maintaining other plugin functionality, but does not address the root cause; patching is the definitive fix. Alternatively, restrict REST API access at the web server level (nginx/Apache) to authenticated requests only, though this may break other legitimate REST integrations. Consult Wordfence's advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/17452a29-bcef-451a-9893-a436ac5d3b80 for the latest patch details and configuration guidance.